All packages
E-Sic 1.0 vulnerabilities
4 known CVE vulnerabilities in E-Sic 1.0, translated and rated.
- CVE-2017-15378High
SQL Injection exists in the E-Sic 1.0 password reset parameter (aka the cpfcnpj parameter to the /reset URI).
- CVE-2017-15381Critical
SQL Injection exists in E-Sic 1.0 via the f parameter to the zip code search script (buscacep.php).
- CVE-2017-15379Critical
An authentication bypass exists in E-Sic 1.0 via '=' or 'or' values for the username and password in the /index (login) URI.
- CVE-2017-15373Critical
E-Sic version 1.0 allows SQL injection via the q parameter in the esiclivre/restrito/inc/lkpcep.php file, which is part of the private search area.